portalbot-command[.]pages[.]dev

This domain, portalbot-command.pages.dev, is identified as a crypto wallet drainer phishing site designed to compromise digital asset wallets under the guise of "Multiverse Deep Sync" functionality. The page title, "Multiverse Deep Sync - One wallet, multiverse support," suggests a fraudulent service promising cross-chain wallet compatibility, a common tactic to lure users into connecting wallets to malicious smart contracts. Once connected, these drainers automatically execute unauthorized transactions, transferring cryptocurrency to attacker-controlled addresses without user consent. The threat specifically targets users of multichain wallets, exploiting their need for interoperability across blockchain networks. Analysis indicates the domain was registered through Cloudflare, Inc., on March 24, 2026, and resolves to the IP address 172.66.44.88. As of the latest scan, the domain has 0 detections out of 95 engines on VirusTotal, indicating it has not yet been widely flagged by security vendors. However, it appears on at least one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. The site employs HSTS, Cloudflare CDN, and HTTP/3, suggesting an attempt to mimic legitimate infrastructure while evading detection. The SSL certificate is issued by Google Trust Services, adding a layer of apparent legitimacy to the phishing page. Users who visited portalbot-command.pages.dev and connected a wallet should immediately disconnect the wallet from all dApps via their wallet settings. They should then revoke any suspicious smart contract approvals using a blockchain explorer or a dedicated revocation tool. It is critical to transfer remaining assets to a new, secure wallet and monitor transaction history for unauthorized activity. If credentials or seed phrases were entered, the compromised wallet should be considered permanently compromised. Users are advised to report the domain to their wallet provider and relevant security teams to aid in broader mitigation efforts.